maps-service/pkg/service/submissions.go

package service

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"time"

	"git.itzana.me/strafesnet/go-grpc/maps"
	"git.itzana.me/strafesnet/maps-service/pkg/api"
	"git.itzana.me/strafesnet/maps-service/pkg/datastore"
	"git.itzana.me/strafesnet/maps-service/pkg/model"
)

var(
	CreationPhaseSubmissionsLimit = 20
	CreationPhaseSubmissionStatuses = []model.SubmissionStatus{
		model.SubmissionStatusChangesRequested,
		model.SubmissionStatusSubmitted,
		model.SubmissionStatusUnderConstruction,
	}
	// limit mapfixes in the pipeline to one per target map
	ActiveAcceptedSubmissionStatuses = []model.SubmissionStatus{
		model.SubmissionStatusUploading,
		model.SubmissionStatusValidated,
		model.SubmissionStatusValidating,
		model.SubmissionStatusAcceptedUnvalidated,
	}
	// Allow 5 submissions every 10 minutes
	CreateSubmissionRateLimit int64 = 5
	CreateSubmissionRecencyWindow = time.Second*600
)

var (
	ErrCreationPhaseSubmissionsLimit = errors.New("Active submissions limited to 20")
	ErrUploadedAssetIDAlreadyExists = errors.New("The submission UploadedAssetID is already set")
	ErrReleaseInvalidStatus = errors.New("Only submissions with Uploaded status can be released")
	ErrReleaseNoUploadedAssetID = errors.New("Only submissions with a UploadedAssetID can be released")
	ErrAcceptOwnSubmission = fmt.Errorf("%w: You cannot accept your own submission as the submitter", ErrPermissionDenied)
	ErrCreateSubmissionRateLimit = errors.New("You must not create more than 5 submissions every 10 minutes")
)

// POST /submissions
func (svc *Service) CreateSubmission(ctx context.Context, request *api.SubmissionTriggerCreate) (*api.OperationID, error) {
	// sanitization
	if request.AssetID<0{
		return nil, ErrNegativeID
	}
	var ModelID=uint64(request.AssetID);

	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return nil, ErrUserInfo
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return nil, err
	}

	// Check if user's submissions in the creation phase exceeds the limit
	{
		filter := datastore.Optional()
		filter.Add("submitter", int64(userId))
		filter.Add("status_id", CreationPhaseSubmissionStatuses)
		creation_submissions, err := svc.DB.Submissions().List(ctx, filter, model.Page{
			Number: 1,
			Size:   int32(CreationPhaseSubmissionsLimit),
		},datastore.ListSortDisabled)
		if err != nil {
			return nil, err
		}

		if CreationPhaseSubmissionsLimit <= len(creation_submissions) {
			return nil, ErrCreationPhaseSubmissionsLimit
		}
	}

	// Check if too many operations have been created recently
	{
		count, err := svc.DB.Operations().CountSince(ctx,
			int64(userId),
			time.Now().Add(-CreateSubmissionRecencyWindow),
		)
		if err != nil {
			return nil, err
		}

		if CreateSubmissionRateLimit < count {
			return nil, ErrCreateSubmissionRateLimit
		}
	}

	operation, err := svc.DB.Operations().Create(ctx, model.Operation{
		Owner:         userId,
		StatusID:      model.OperationStatusCreated,
	})
	if err != nil {
		return nil, err
	}

	create_request := model.CreateSubmissionRequest{
		OperationID: operation.ID,
		ModelID:     ModelID,
		DisplayName: request.DisplayName,
		Creator:     request.Creator,
		GameID:      uint32(request.GameID),
		Status:      uint32(model.SubmissionStatusUnderConstruction),
		Roles:       uint32(RolesEmpty),
	}

	j, err := json.Marshal(create_request)
	if err != nil {
		return nil, err
	}

	_, err = svc.Nats.Publish("maptest.submissions.create", []byte(j))
	if err != nil {
		return nil, err
	}

	return &api.OperationID{
		OperationID: operation.ID,
	}, nil
}
// POST /submissions-admin
func (svc *Service) CreateSubmissionAdmin(ctx context.Context, request *api.SubmissionTriggerCreate) (*api.OperationID, error) {
	// sanitization
	if request.AssetID<0{
		return nil, ErrNegativeID
	}
	var ModelID=uint64(request.AssetID);

	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return nil, ErrUserInfo
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return nil, err
	}

	roles, err := userInfo.GetRoles()
	if err != nil {
		return nil, err
	}

	// check if caller has required role
	has_role := roles & RolesSubmissionReview == RolesSubmissionReview
	if !has_role {
		return nil, ErrPermissionDeniedNeedRoleSubmissionReview
	}

	// Check if too many operations have been created recently
	{
		count, err := svc.DB.Operations().CountSince(ctx,
			int64(userId),
			time.Now().Add(-CreateSubmissionRecencyWindow),
		)
		if err != nil {
			return nil, err
		}

		if CreateSubmissionRateLimit < count {
			return nil, ErrCreateSubmissionRateLimit
		}
	}

	operation, err := svc.DB.Operations().Create(ctx, model.Operation{
		Owner:         userId,
		StatusID:      model.OperationStatusCreated,
	})
	if err != nil {
		return nil, err
	}

	create_request := model.CreateSubmissionRequest{
		OperationID: operation.ID,
		ModelID:     ModelID,
		DisplayName: request.DisplayName,
		Creator:     request.Creator,
		GameID:      uint32(request.GameID),
		Status:      uint32(model.SubmissionStatusChangesRequested),
		Roles:       uint32(roles),
	}

	j, err := json.Marshal(create_request)
	if err != nil {
		return nil, err
	}

	_, err = svc.Nats.Publish("maptest.submissions.create", []byte(j))
	if err != nil {
		return nil, err
	}

	return &api.OperationID{
		OperationID: operation.ID,
	}, nil
}

// GetSubmission implements getSubmission operation.
//
// Retrieve map with ID.
//
// GET /submissions/{SubmissionID}
func (svc *Service) GetSubmission(ctx context.Context, params api.GetSubmissionParams) (*api.Submission, error) {
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return nil, err
	}
	return &api.Submission{
		ID:            submission.ID,
		DisplayName:   submission.DisplayName,
		Creator:       submission.Creator,
		GameID:        int32(submission.GameID),
		CreatedAt:     submission.CreatedAt.Unix(),
		UpdatedAt:     submission.UpdatedAt.Unix(),
		Submitter:     int64(submission.Submitter),
		AssetID:       int64(submission.AssetID),
		AssetVersion:  int64(submission.AssetVersion),
		Completed:     submission.Completed,
		UploadedAssetID: api.NewOptInt64(int64(submission.UploadedAssetID)),
		StatusID:      int32(submission.StatusID),
	}, nil
}

// ListSubmissions implements listSubmissions operation.
//
// Get list of submissions.
//
// GET /submissions
func (svc *Service) ListSubmissions(ctx context.Context, params api.ListSubmissionsParams) (*api.Submissions, error) {
	filter := datastore.Optional()

	if params.DisplayName.IsSet(){
		filter.Add("display_name", params.DisplayName.Value)
	}
	if params.Creator.IsSet(){
		filter.Add("creator", params.Creator.Value)
	}
	if params.GameID.IsSet(){
		filter.Add("game_id", params.GameID.Value)
	}
	if params.Submitter.IsSet(){
		filter.Add("submitter", params.Submitter.Value)
	}
	if params.AssetID.IsSet(){
		filter.Add("asset_id", params.AssetID.Value)
	}
	if params.UploadedAssetID.IsSet(){
		filter.Add("uploaded_asset_id", params.UploadedAssetID.Value)
	}
	if params.StatusID.IsSet(){
		filter.Add("status_id", params.StatusID.Value)
	}

	sort := datastore.ListSort(params.Sort.Or(int32(datastore.ListSortDisabled)))

	total, items, err := svc.DB.Submissions().ListWithTotal(ctx, filter, model.Page{
		Number: params.Page,
		Size:   params.Limit,
	},sort)
	if err != nil {
		return nil, err
	}

	var resp api.Submissions
	resp.Total=total
	for _, item := range items {
		resp.Submissions = append(resp.Submissions, api.Submission{
			ID:            item.ID,
			DisplayName:   item.DisplayName,
			Creator:       item.Creator,
			GameID:        int32(item.GameID),
			CreatedAt:     item.CreatedAt.Unix(),
			UpdatedAt:     item.UpdatedAt.Unix(),
			Submitter:     int64(item.Submitter),
			AssetID:       int64(item.AssetID),
			AssetVersion:  int64(item.AssetVersion),
			Completed:     item.Completed,
			UploadedAssetID: api.NewOptInt64(int64(item.UploadedAssetID)),
			StatusID:      int32(item.StatusID),
		})
	}

	return &resp, nil
}

// PatchSubmissionCompleted implements patchSubmissionCompleted operation.
//
// Retrieve map with ID.
//
// POST /submissions/{SubmissionID}/completed
func (svc *Service) SetSubmissionCompleted(ctx context.Context, params api.SetSubmissionCompletedParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleMaptest()
	if err != nil {
		return err
	}
	// check if caller has MaptestGame role (request must originate from a maptest roblox game)
	if !has_role {
		return ErrPermissionDeniedNeedRoleMaptest
	}

	pmap := datastore.Optional()
	pmap.Add("completed", true)
	return svc.DB.Submissions().Update(ctx, params.SubmissionID, pmap)
}

// UpdateSubmissionModel implements patchSubmissionModel operation.
//
// Update model following role restrictions.
//
// POST /submissions/{SubmissionID}/model
func (svc *Service) UpdateSubmissionModel(ctx context.Context, params api.UpdateSubmissionModelParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	// read submission (this could be done with a transaction WHERE clause)
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check if caller is the submitter
	has_role := userId == submission.Submitter
	if !has_role {
		return ErrPermissionDeniedNotSubmitter
	}

	OldModelID := submission.AssetID
	OldModelVersion := submission.AssetVersion
	NewModelID := uint64(params.ModelID)
	NewModelVersion := uint64(params.ModelVersion)

	// check if Status is ChangesRequested|Submitted|UnderConstruction
	pmap := datastore.Optional()
	pmap.Add("asset_id", NewModelID)
	pmap.Add("asset_version", NewModelVersion)
	//always reset completed when model changes
	pmap.Add("completed", false)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusChangesRequested, model.SubmissionStatusUnderConstruction}, pmap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataChangeModel{
		OldModelID: OldModelID,
		OldModelVersion: OldModelVersion,
		NewModelID: NewModelID,
		NewModelVersion: NewModelVersion,
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   submission.ID,
		EventType:    model.AuditEventTypeChangeModel,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionReject invokes actionSubmissionReject operation.
//
// Role Reviewer changes status from Submitted -> Rejected.
//
// POST /submissions/{SubmissionID}/status/reject
func (svc *Service) ActionSubmissionReject(ctx context.Context, params api.ActionSubmissionRejectParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionReview
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// transaction
	target_status := model.SubmissionStatusRejected
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusSubmitted}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionRequestChanges invokes actionSubmissionRequestChanges operation.
//
// Role Reviewer changes status from Validated|Accepted|Submitted -> ChangesRequested.
//
// POST /submissions/{SubmissionID}/status/request-changes
func (svc *Service) ActionSubmissionRequestChanges(ctx context.Context, params api.ActionSubmissionRequestChangesParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionReview
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// transaction
	target_status := model.SubmissionStatusChangesRequested
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusValidated, model.SubmissionStatusAcceptedUnvalidated, model.SubmissionStatusSubmitted}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionRevoke invokes actionSubmissionRevoke operation.
//
// Role Submitter changes status from Submitted|ChangesRequested -> UnderConstruction.
//
// POST /submissions/{SubmissionID}/status/revoke
func (svc *Service) ActionSubmissionRevoke(ctx context.Context, params api.ActionSubmissionRevokeParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	// read submission (this could be done with a transaction WHERE clause)
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check if caller is the submitter
	has_role := userId == submission.Submitter
	if !has_role {
		return ErrPermissionDeniedNotSubmitter
	}

	// transaction
	target_status := model.SubmissionStatusUnderConstruction
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusSubmitted, model.SubmissionStatusChangesRequested}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionTriggerSubmit invokes actionSubmissionTriggerSubmit operation.
//
// Role Submitter changes status from UnderConstruction|ChangesRequested -> Submitting.
//
// POST /submissions/{SubmissionID}/status/trigger-submit
func (svc *Service) ActionSubmissionTriggerSubmit(ctx context.Context, params api.ActionSubmissionTriggerSubmitParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	// read submission (this could be done with a transaction WHERE clause)
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	has_submission_review, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}

	// check if caller is the submitter
	is_submitter := userId == submission.Submitter
	// neither = deny
	if !is_submitter && !has_submission_review {
		return ErrPermissionDeniedNotSubmitter
	}

	// transaction
	target_status := model.SubmissionStatusSubmitting
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusUnderConstruction, model.SubmissionStatusChangesRequested}, smap)
	if err != nil {
		return err
	}

	validate_request := model.CheckSubmissionRequest{
		SubmissionID: submission.ID,
		ModelID:      submission.AssetID,
	}

	j, err := json.Marshal(validate_request)
	if err != nil {
		return err
	}

	_, err = svc.Nats.Publish("maptest.submissions.check", []byte(j))
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionResetSubmitting implements actionSubmissionResetSubmitting operation.
//
// Role SubmissionReview changes status from Submitting -> UnderConstruction.
//
// POST /submissions/{SubmissionID}/status/reset-submitting
func (svc *Service) ActionSubmissionResetSubmitting(ctx context.Context, params api.ActionSubmissionResetSubmittingParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check when submission was updated
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}
	if time.Now().Before(submission.UpdatedAt.Add(time.Second*10)) {
		// the last time the submission was updated must be longer than 10 seconds ago
		return ErrDelayReset
	}

	// check if caller has required role
	has_role := userId == submission.Submitter
	if !has_role {
		return ErrPermissionDeniedNotSubmitter
	}

	// transaction
	target_status := model.SubmissionStatusUnderConstruction
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusSubmitting}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionTriggerUpload invokes actionSubmissionTriggerUpload operation.
//
// Role Admin changes status from Validated -> Uploading.
//
// POST /submissions/{SubmissionID}/status/trigger-upload
func (svc *Service) ActionSubmissionTriggerUpload(ctx context.Context, params api.ActionSubmissionTriggerUploadParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionUpload()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionUpload
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// transaction
	target_status := model.SubmissionStatusUploading
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	submission, err := svc.DB.Submissions().IfStatusThenUpdateAndGet(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusValidated}, smap)
	if err != nil {
		return err
	}

	// sentinel value because we are not using rust
	if submission.UploadedAssetID == 0 {
		// this is a new map
		upload_new_request := model.UploadSubmissionRequest{
			SubmissionID: submission.ID,
			ModelID:      submission.ValidatedAssetID,
			ModelVersion: submission.ValidatedAssetVersion,
			// upload as displayname, whatever
			ModelName:    submission.DisplayName,
		}

		j, err := json.Marshal(upload_new_request)
		if err != nil {
			return err
		}

		_, err = svc.Nats.Publish("maptest.submissions.upload", []byte(j))
		if err != nil {
			return err
		}
	} else {
		// refuse to operate
		return ErrUploadedAssetIDAlreadyExists
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionValidate invokes actionSubmissionValidate operation.
//
// Role SubmissionRelease changes status from Uploading -> Validated.
//
// POST /submissions/{SubmissionID}/status/reset-uploading
func (svc *Service) ActionSubmissionValidated(ctx context.Context, params api.ActionSubmissionValidatedParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionUpload()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionUpload
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check when submission was updated
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}
	if time.Now().Before(submission.UpdatedAt.Add(time.Second*10)) {
		// the last time the submission was updated must be longer than 10 seconds ago
		return ErrDelayReset
	}

	// transaction
	target_status := model.SubmissionStatusValidated
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusUploading}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionTriggerValidate invokes actionSubmissionTriggerValidate operation.
//
// Role Reviewer triggers validation and changes status from Submitted -> Validating.
//
// POST /submissions/{SubmissionID}/status/trigger-validate
func (svc *Service) ActionSubmissionTriggerValidate(ctx context.Context, params api.ActionSubmissionTriggerValidateParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionReview
	}

	// read submission (this could be done with a transaction WHERE clause)
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check if caller is NOT the submitter
	has_role = userId == submission.Submitter
	if has_role {
		return ErrAcceptOwnSubmission
	}

	// transaction
	target_status := model.SubmissionStatusValidating
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	submission, err = svc.DB.Submissions().IfStatusThenUpdateAndGet(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusSubmitted}, smap)
	if err != nil {
		return err
	}

	validate_request := model.ValidateSubmissionRequest{
		SubmissionID:     submission.ID,
		ModelID:          submission.AssetID,
		ModelVersion:     submission.AssetVersion,
		ValidatedModelID: nil,
	}

	// sentinel values because we're not using rust
	if submission.ValidatedAssetID != 0 {
		validate_request.ValidatedModelID = &submission.ValidatedAssetID
	}

	j, err := json.Marshal(validate_request)
	if err != nil {
		return err
	}

	_, err = svc.Nats.Publish("maptest.submissions.validate", []byte(j))
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionRetryValidate invokes actionSubmissionRetryValidate operation.
//
// Role Reviewer re-runs validation and changes status from Accepted -> Validating.
//
// POST /submissions/{SubmissionID}/status/retry-validate
func (svc *Service) ActionSubmissionRetryValidate(ctx context.Context, params api.ActionSubmissionRetryValidateParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionReview
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// transaction
	target_status := model.SubmissionStatusValidating
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	submission, err := svc.DB.Submissions().IfStatusThenUpdateAndGet(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusAcceptedUnvalidated}, smap)
	if err != nil {
		return err
	}

	validate_request := model.ValidateSubmissionRequest{
		SubmissionID:     submission.ID,
		ModelID:          submission.AssetID,
		ModelVersion:     submission.AssetVersion,
		ValidatedModelID: nil,
	}

	// sentinel values because we're not using rust
	if submission.ValidatedAssetID != 0 {
		validate_request.ValidatedModelID = &submission.ValidatedAssetID
	}

	j, err := json.Marshal(validate_request)
	if err != nil {
		return err
	}

	_, err = svc.Nats.Publish("maptest.submissions.validate", []byte(j))
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ActionSubmissionAccepted implements actionSubmissionAccepted operation.
//
// Role SubmissionReview changes status from Validating -> Accepted.
//
// POST /submissions/{SubmissionID}/status/reset-validating
func (svc *Service) ActionSubmissionAccepted(ctx context.Context, params api.ActionSubmissionAcceptedParams) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionReview()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionReview
	}

	userId, err := userInfo.GetUserID()
	if err != nil {
		return err
	}

	// check when submission was updated
	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
	if err != nil {
		return err
	}
	if time.Now().Before(submission.UpdatedAt.Add(time.Second*10)) {
		// the last time the submission was updated must be longer than 10 seconds ago
		return ErrDelayReset
	}

	// transaction
	target_status := model.SubmissionStatusAcceptedUnvalidated
	smap := datastore.Optional()
	smap.Add("status_id", target_status)
	err = svc.DB.Submissions().IfStatusThenUpdate(ctx, params.SubmissionID, []model.SubmissionStatus{model.SubmissionStatusValidating}, smap)
	if err != nil {
		return err
	}

	event_data := model.AuditEventDataAction{
		TargetStatus: uint32(target_status),
	}

	EventData, err := json.Marshal(event_data)
	if err != nil {
		return err
	}

	_, err = svc.DB.AuditEvents().Create(ctx, model.AuditEvent{
		ID:           0,
		User:         userId,
		ResourceType: model.ResourceSubmission,
		ResourceID:   params.SubmissionID,
		EventType:    model.AuditEventTypeAction,
		EventData:    EventData,
	})
	if err != nil {
		return err
	}

	return nil
}

// ReleaseSubmissions invokes releaseSubmissions operation.
//
// Release a set of uploaded maps.
//
// POST /release-submissions
func (svc *Service) ReleaseSubmissions(ctx context.Context, request []api.ReleaseInfo) error {
	userInfo, ok := ctx.Value("UserInfo").(UserInfoHandle)
	if !ok {
		return ErrUserInfo
	}

	has_role, err := userInfo.HasRoleSubmissionRelease()
	if err != nil {
		return err
	}
	// check if caller has required role
	if !has_role {
		return ErrPermissionDeniedNeedRoleSubmissionRelease
	}

	idList := make([]int64, len(request))
	for i, releaseInfo := range request {
		idList[i] = releaseInfo.SubmissionID
	}

	// fetch submissions
	submissions, err := svc.DB.Submissions().GetList(ctx, idList)
	if err != nil {
		return err
	}

	// check each submission to make sure it is ready to release
	for _,submission := range submissions{
		if submission.StatusID != model.SubmissionStatusUploaded{
			return ErrReleaseInvalidStatus
		}
		if submission.UploadedAssetID == 0{
			return ErrReleaseNoUploadedAssetID
		}
	}

	for i,submission := range submissions{
		date := request[i].Date.Unix()
		var GameID = int32(submission.GameID)
		// create each map with go-grpc
		_, err := svc.Maps.Create(ctx, &maps.MapRequest{
			ID:          int64(submission.UploadedAssetID),
			DisplayName: &submission.DisplayName,
			Creator:     &submission.Creator,
			GameID:      &GameID,
			Date:        &date,
		})
		if err != nil {
			return err
		}

		// update each status to Released
		smap := datastore.Optional()
		smap.Add("status_id", model.SubmissionStatusReleased)
		err = svc.DB.Submissions().IfStatusThenUpdate(ctx, submission.ID, []model.SubmissionStatus{model.SubmissionStatusUploaded}, smap)
		if err != nil {
			return err
		}
	}

	return nil
}